The PTG Digital Forensics Lab
Court-ready forensic examinations, expert witness testimony, and legally defensible evidence handling from a dedicated forensics lab serving Raleigh, Durham, Chapel Hill, and courts across North Carolina since 2002.
Expert Witness Testimony in Action
Craig Petronella delivers expert witness testimony on digital forensics and cybersecurity matters in North Carolina courts.
Inside the PTG Digital Forensics Lab
The Petronella Technology Group Digital Forensics Lab is a dedicated forensic examination facility located in Raleigh, North Carolina. Unlike general IT service providers that offer forensic work as a secondary capability, PTG maintains a purpose-built forensic practice with the specialized equipment, controlled environment, and chain of custody protocols that the legal system demands. Our lab is where raw digital media is transformed into court-ready evidence through rigorous, repeatable scientific processes that have withstood adversarial scrutiny in state and federal proceedings across North Carolina.
The lab is equipped with enterprise-grade forensic workstations, write-blocking hardware for every major interface type including SATA, NVMe, USB, and legacy IDE connections, and secure evidence storage that maintains strict chain of custody from intake through final disposition. Every piece of evidence that enters the lab is logged, photographed, hashed, and tracked through a documented custody protocol. Our forensic imaging systems create verified bit-for-bit copies of storage media using dual-hash verification, meaning SHA-256 and MD5 hashes are calculated simultaneously and validated to confirm that not a single byte has been altered during the acquisition process.
The PTG forensic practice serves a distinct function from our managed IT and cybersecurity consulting services. While those services focus on prevention, monitoring, and incident response, the forensic lab is a fact-finding operation. Its purpose is the scientific examination of digital evidence to establish what happened, when it happened, how it happened, and who was responsible. The findings produced in this lab are intended for consumption by attorneys, judges, juries, insurance adjusters, corporate boards, and regulatory agencies. Every report, every analysis, and every conclusion that leaves this lab is prepared with the assumption that it will be challenged under oath.
Since 2002, PTG has served more than 2,500 clients across the Research Triangle and throughout North Carolina. The forensic lab has supported investigations involving Fortune 500 companies, small businesses, law firms, government agencies, and individual litigants. Our work spans civil and criminal matters, from intellectual property theft and employee misconduct to ransomware attacks and multi-million-dollar fraud cases. The lab operates under the same evidentiary standards regardless of case size, because the integrity of forensic evidence does not depend on the dollar amount in dispute.
Craig Petronella, Licensed Digital Forensic Examiner
Craig Petronella is the founder and CEO of Petronella Technology Group and serves as the firm's lead Licensed Digital Forensic Examiner. With more than 25 years of hands-on experience in cybersecurity, digital forensics, and IT infrastructure, Craig has built one of the Research Triangle's most respected forensic practices. His work combines deep technical expertise with the communication skills required to translate complex forensic findings into clear, persuasive testimony that judges and juries can understand and act upon.
As a Licensed Digital Forensic Examiner, Craig operates under the professional standards and ethical obligations that North Carolina law imposes on forensic practitioners. This licensure is not a voluntary certification; it is a state-regulated designation that requires demonstrated competence, continuing education, and adherence to professional standards of conduct. When Craig signs a forensic report or takes the stand as an expert witness, his findings carry the weight of a licensed professional who is personally accountable for the accuracy and integrity of his work.
Craig holds a CMMC Certified Registered Practitioner designation and MIT certifications in cybersecurity, artificial intelligence, blockchain, and compliance. He is the Amazon number-one best-selling author of multiple books on cybersecurity and compliance, including "How HIPAA Can Crush Your Medical Practice," "How Hackers Can Crush Your Law Firm," and "The Ultimate Guide To CMMC." His expertise has been recognized by major media outlets, with featured appearances on ABC, CBS, NBC, FOX, and WRAL, where he has provided expert commentary on cybercrime, data breaches, and digital privacy.
Beyond his forensic practice, Craig serves as an expert witness for law firms throughout North Carolina and beyond, providing depositions and courtroom testimony in cases involving cybercrime, data breaches, intellectual property theft, compliance failures, and digital evidence authentication. His ability to explain highly technical forensic concepts in plain language, while maintaining scientific precision, makes him an effective advocate for the truth in adversarial legal proceedings. Attorneys on both sides of the aisle seek Craig's expertise because his findings are rooted in evidence and his methodology is transparent, reproducible, and defensible.
Forensic Examination Capabilities
Our forensic lab maintains the equipment, software, and expertise to examine evidence across every major digital platform and device category.
Computer and Server Forensics
Forensic imaging and analysis of desktops, laptops, servers, and workstations running Windows, macOS, and Linux operating systems. We examine file systems, registry artifacts, event logs, user activity, application data, browser history, email databases, and deleted or hidden data. Our analysis extends to encrypted volumes, virtual machines, and RAID arrays, with the capability to recover data from damaged or failing storage media.
Mobile Device Forensics
Extraction and analysis of data from smartphones, tablets, and wearable devices across iOS and Android platforms. We recover text messages, call logs, contacts, photos, videos, application data, GPS location history, Wi-Fi connection records, and deleted content. Our mobile forensics capabilities include logical, file system, and physical extractions depending on the device model, operating system version, and encryption status.
Network and Log Forensics
Analysis of network traffic captures, firewall logs, intrusion detection and prevention system alerts, DNS query logs, DHCP lease records, VPN connection logs, and authentication records. We reconstruct network-based activity to identify unauthorized access, data exfiltration paths, lateral movement by attackers, and communication between compromised systems and command-and-control infrastructure.
Cloud and SaaS Forensics
Forensic examination of cloud environments including Amazon Web Services, Microsoft Azure, Google Cloud Platform, Microsoft 365, and Google Workspace. Cloud forensics requires specialized techniques because evidence is distributed, volatile, and governed by provider-specific access mechanisms. We collect and preserve cloud-based evidence including access logs, file modification histories, sharing permissions, and administrative audit trails.
Email and Communications Forensics
Detailed analysis of email communications including header examination, routing analysis, attachment investigation, and metadata extraction. We trace the origin and path of email messages, identify spoofed or forged communications, analyze business email compromise attacks, and recover deleted correspondence from mail servers, local archives, and cloud-based email platforms. This work is frequently central to fraud, harassment, and intellectual property cases.
Malware and Ransomware Analysis
Controlled examination of malware specimens including ransomware, trojans, rootkits, keyloggers, and remote access tools. We perform both static and dynamic analysis to determine the malware's capabilities, behavior, communication patterns, and indicators of compromise. Our findings identify the attack vector, the scope of the compromise, and the specific data that was accessed or exfiltrated, providing critical intelligence for both remediation and legal proceedings.
Cryptocurrency and Blockchain Analysis
Tracing and analysis of cryptocurrency transactions across major blockchain networks. In cases involving ransomware payments, fraud, money laundering, or SIM swap attacks, we trace the flow of funds through blockchain addresses, identify exchange interactions, and document transaction histories. This capability is increasingly important as cybercriminals adopt cryptocurrency as their preferred payment mechanism.
Data Recovery and Reconstruction
Recovery of data from damaged, corrupted, encrypted, or intentionally wiped storage devices. We employ forensic recovery techniques that go beyond standard data recovery services, including examination of file system slack space, unallocated disk areas, and residual data in memory dumps. When evidence has been deliberately destroyed, we document the anti-forensic techniques used, which can itself be powerful evidence of intent and consciousness of guilt.
Expert Witness and Courtroom Testimony
When digital evidence must be presented in court, the credibility and clarity of the expert witness can determine the outcome. Craig Petronella provides expert testimony that translates complex technical findings into language that judges, juries, and opposing counsel can evaluate.
What Our Expert Witness Services Include
Deposition and Trial Testimony: Craig Petronella provides sworn testimony in depositions and at trial, presenting forensic findings with the clarity and precision that legal proceedings demand. His testimony covers the methodology used, the evidence examined, the conclusions reached, and the basis for those conclusions. Years of courtroom experience have refined his ability to withstand rigorous cross-examination while maintaining composure and credibility.
Forensic Expert Reports: Our expert reports are comprehensive documents that detail the scope of the examination, the tools and methods employed, the chain of custody documentation, the findings, and the examiner's professional opinions. These reports are written to satisfy the requirements of Rule 702 of the North Carolina Rules of Evidence and Federal Rule of Evidence 702, which govern the admissibility of expert testimony. Every opinion expressed in our reports is supported by the evidence and explained in sufficient detail that another qualified examiner could reproduce the analysis.
Opposing Expert Review: We review and analyze the forensic reports, methodology, and conclusions of opposing experts. This peer review process identifies gaps, errors, unsupported conclusions, and methodological weaknesses in the opposing expert's work. Our critique is fact-based and technical, providing your legal team with specific areas to challenge during cross-examination.
Litigation Consulting: Before and during litigation, we work directly with your legal team to help them understand the technical aspects of the case, formulate questions for depositions and cross-examinations, evaluate the strength of digital evidence, and develop the technical narrative of the case. Our litigation consulting ensures that attorneys are fully prepared to present or challenge digital evidence effectively.
eDiscovery Support: We assist with the identification, preservation, collection, processing, review, and production of electronically stored information in litigation. Our eDiscovery support ensures that relevant data is collected in a defensible manner, processed efficiently, and produced in the format required by the court or opposing counsel. We help legal teams navigate the technical complexities of electronic data while maintaining compliance with discovery obligations.
The PTG Forensic Examination Process
Our forensic methodology follows NIST Special Publication 800-86 guidelines and the Scientific Working Group on Digital Evidence (SWGDE) best practices, ensuring defensible and reproducible results.
-
Initial Consultation and Case Assessment
Every engagement begins with a confidential consultation to understand the facts, the legal context, the timeline, and the desired outcomes. We assess the scope of the potential examination, identify likely evidence sources, discuss preservation requirements, and provide a preliminary estimate of cost and timeline. For active litigation, we coordinate directly with your legal counsel to ensure that our work falls within the scope of attorney-client privilege or work product protection as appropriate.
-
Evidence Identification and Collection
We identify all potential sources of relevant digital evidence, including computers, servers, mobile devices, cloud accounts, network equipment, backup systems, and removable media. Evidence collection is performed using forensically sound methods that preserve the original data in its unaltered state. We use hardware write-blockers to prevent any modification to original media, and we document every step of the collection process to establish an unbroken chain of custody.
-
Forensic Imaging and Verification
We create exact bit-for-bit forensic images of all evidence media. Each image is verified using dual-hash algorithms, with both SHA-256 and MD5 checksums calculated and recorded. The forensic images, not the original media, are used for all subsequent analysis. This approach preserves the original evidence in its pristine state while providing our examiners with complete working copies. Original evidence is stored in our secure evidence room under documented chain of custody.
-
Systematic Analysis and Examination
Our forensic examiners analyze the evidence using industry-validated tools and techniques. The analysis is guided by the specific questions the case presents, but is conducted with sufficient breadth to identify relevant evidence that may not have been anticipated. We examine file systems, application artifacts, communication records, user activity timelines, metadata, deleted and hidden data, and system logs. Every finding is documented with reference to its source, enabling independent verification.
-
Timeline Reconstruction and Correlation
We construct detailed timelines of relevant activity by correlating evidence across multiple sources. File system timestamps, email headers, log entries, authentication records, and application artifacts are integrated into a unified chronology that reveals the sequence of events. This timeline becomes a powerful analytical tool for understanding what happened and for presenting findings in a narrative format that is accessible to non-technical audiences.
-
Reporting and Expert Testimony
Our forensic reports document the entire examination process: the evidence received, the methods used, the analysis performed, the findings, and the examiner's professional conclusions. Reports are written to be technically rigorous while remaining comprehensible to attorneys, judges, and juries. When testimony is required, Craig Petronella is available for depositions and courtroom appearances, presenting findings with clarity, confidence, and the credibility of a licensed forensic examiner.
Types of Cases We Investigate
Our forensic lab supports investigations across a broad range of civil, criminal, regulatory, and corporate matters. Below are the primary case categories we handle.
Cybercrime and Data Breaches
Investigation of unauthorized access, hacking incidents, ransomware attacks, phishing compromises, and data exfiltration events. We determine the scope of the breach, identify the attack vector, document the data affected, and produce findings that satisfy regulatory notification requirements and support law enforcement referrals.
Intellectual Property Theft
Forensic examination of devices and accounts to identify unauthorized copying, transmission, or deletion of proprietary information, trade secrets, source code, customer lists, and confidential business data. We trace data movement, document exfiltration methods, and establish timelines that correlate with employee departures or competitive activity.
Employee Misconduct
Investigation of policy violations, unauthorized system access, misuse of company resources, harassment via electronic communications, and sabotage. We collect and analyze digital evidence in a manner that is both legally sound and consistent with employment law requirements, including considerations around reasonable expectation of privacy.
Fraud and Financial Crimes
Digital forensics in support of fraud investigations including business email compromise, wire fraud, insurance fraud, embezzlement, and cryptocurrency-related financial crimes. We trace electronic communications, financial transactions, and document manipulation to build the evidentiary foundation for civil recovery or criminal prosecution.
Family Law and Domestic Cases
Forensic examination of digital evidence in custody disputes, divorce proceedings, and protective order cases. We handle these sensitive matters with discretion while maintaining the same forensic rigor applied to commercial cases. Evidence from phones, computers, social media accounts, and location data can be critical in family court proceedings.
Regulatory and Compliance Investigations
Forensic support for investigations triggered by regulatory inquiries from bodies such as the HHS Office for Civil Rights (HIPAA), the FTC, state attorneys general, and industry-specific regulators. We produce evidence and documentation that satisfies the specific requirements of the applicable regulatory framework, including HIPAA, PCI DSS, SOC 2, and CMMC.
Insurance Claims
Forensic investigation in support of cyber insurance claims, providing carriers and policyholders with the detailed technical documentation needed to evaluate claims, determine coverage, and quantify losses. Our reports document the incident timeline, root cause, data exposure, and remediation costs with the specificity that adjusters require.
SIM Swap and Identity Fraud
Investigation of SIM swap attacks and identity-related cybercrimes where attackers take control of phone numbers to bypass two-factor authentication and access financial accounts. We trace the attack chain from the social engineering of the carrier through the compromise of accounts and movement of funds, providing evidence for both civil recovery and criminal referral.
Evidence Handling and Chain of Custody
The admissibility of digital evidence in court depends on an unbroken chain of custody and demonstrable evidence integrity. A single gap in documentation or a single unverified step in the handling process can render evidence inadmissible, regardless of how compelling the findings might be. The PTG Digital Forensics Lab treats chain of custody as foundational, not supplementary, to every forensic engagement.
When evidence arrives at our lab, it is immediately logged into our evidence tracking system. Every item is assigned a unique identifier, photographed in its received condition, and documented with details including the source, the date and time of receipt, the condition upon arrival, and the identity of the person who delivered it. From that point forward, every interaction with the evidence is logged: who accessed it, when, for what purpose, and what was done. This creates a complete audit trail that can be presented to the court to demonstrate that the evidence has been properly handled from intake through testimony.
Our evidence storage area is physically secured with access controls that limit entry to authorized forensic personnel. Evidence is stored in conditions that protect it from environmental damage, electromagnetic interference, and unauthorized access. When evidence must be transported, whether to court, to another examiner, or back to the client, the transfer is documented with the same level of detail as the initial intake. Our chain of custody documentation has been accepted without challenge in proceedings in Wake County, Durham County, Orange County, and other jurisdictions across North Carolina.
The integrity of forensic images is verified at every critical step. When a forensic image is created, its hash values are calculated and recorded. Before any analysis session begins, those hash values are recalculated and compared to the original values to confirm that the image has not been altered. This verification process is documented in our forensic reports, providing an unassailable record that the evidence analyzed is an exact, unmodified copy of the original. This discipline is what separates forensic examination from ordinary IT investigation, and it is what makes our findings trustworthy in a legal setting.
Forensic Standards and Certifications
Our forensic practice operates in alignment with recognized standards and frameworks that govern digital forensic examination. Adherence to these standards ensures that our work is consistent, reproducible, and defensible regardless of the venue or the complexity of the matter.
- NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response. Our examination methodology follows the four-phase NIST forensic process: collection, examination, analysis, and reporting.
- SWGDE Best Practices: Scientific Working Group on Digital Evidence guidelines for the forensic examination of digital evidence, including best practices for imaging, analysis, and quality assurance.
- Federal Rules of Evidence (Rule 702): Our expert testimony and reports are prepared to satisfy the Daubert standard and its state equivalents, ensuring admissibility in both federal and North Carolina state courts.
- North Carolina General Statutes Chapter 74F: Our practice complies with the Private Protective Services Act, which governs the licensing and conduct of digital forensic examiners in North Carolina.
- CMMC 2.0 / NIST 800-171: As a CMMC Certified Registered Practitioner, Craig Petronella brings compliance expertise that is directly relevant to forensic investigations involving defense contractors and controlled unclassified information.
PTG holds additional certifications and credentials including CCNA, MCNS, and Microsoft Cloud Essentials. Our team's expertise spans the compliance frameworks most commonly implicated in forensic investigations, including HIPAA, FTC Safeguards Rule, SOC 2 Type II, PCI DSS, GDPR, CCPA, and ISO 27001. This breadth of knowledge allows us to conduct forensic investigations with an awareness of the regulatory context in which the evidence will be used.
Frequently Asked Questions
What makes the PTG forensic lab different from a general IT services company?
What does it mean that Craig Petronella is a Licensed Digital Forensic Examiner?
When should I contact a digital forensics lab?
Is the evidence you collect admissible in North Carolina courts?
Can you recover deleted files and data?
How long does a forensic investigation typically take?
Will the forensic investigation disrupt our business operations?
Can you provide expert witness testimony in federal court?
What areas of North Carolina do you serve?
How do you maintain chain of custody for digital evidence?
What is the difference between this forensic lab page and your digital forensics solutions page?
How much does a forensic investigation cost?
Protect Your Evidence. Protect Your Case.
Digital evidence is fragile and time-sensitive. Whether you are facing a cybersecurity incident, preparing for litigation, or investigating employee misconduct, the sooner you engage a licensed forensic examiner, the stronger your evidentiary position will be.
919-348-4912Petronella Technology Group · 5540 Centerview Dr., Suite 200, Raleigh, NC 27606
BBB Accredited Since 2003 · Serving the Research Triangle Since 2002 · 2,500+ Clients
